[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fXNGdxfZLRZ249Cufck9VEaTyTM09cw62AhMWUVKnr0Q":3},{"article":4,"iocs":41,"watch_terms":50,"solutions":51,"lesson":135},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"1e19be36-ac5b-463e-b607-c4b08ae4a7f3","European authorities take down SteaIC malware servers for second time this year","european-authorities-take-down-steaic-malware-servers-for-second-time-this-year-8d3ba0","German authorities on Thursday said investigators traced the rebuilt network to the Virtualine bulletproof hosting provider, seized by the FBI in October, with the assistance of police in Frankfurt and the Dutch National High Tech Crime Unit.","European police have dismantled over 100 servers used by the StealC password-stealing malware, marking the second major takedown this year. The operation, involving law enforcement from nine countries, also disrupted servers and domains linked to Gootloader and CastleRAT malware. Investigators recovered approximately 6.4 million stolen login credentials from over 40,000 victims. No arrests were made in this latest action.","European authorities dismantle over 100 servers used by StealC malware for the second time this year.","https:\u002F\u002Ftherecord.media\u002Feuropean-authorities-take-down-stealic-malware-second-time","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fpolizei_9dea82a5d6.jpg","2026-11-12T16:21:00+00:00","2026-11-12T17:00:21.075945+00:00",7,[17,20],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"bulletproof hosting","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":23,"icon":25,"name":26,"slug":27},null,"Malware","malware",[29,31,36],{"category":30},{"id":23,"icon":25,"name":26,"slug":27},{"category":32},{"id":33,"icon":25,"name":34,"slug":35},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42,45,48],{"type":27,"value":43,"context":44},"SteaIC","password-stealing malware",{"type":27,"value":46,"context":47},"Gootloader","malware disrupted in operation",{"type":27,"value":49,"context":47},"CastleRAT",[18],{"controls":52,"vendors":134},[53,82,110],{"slug":54,"name":55,"problem":56,"products":57},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[58,66,74],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":40,"name":83,"problem":84,"products":85},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":111,"name":112,"problem":113,"products":114},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[115,121,129],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":116,"product_name":117,"url":119,"description":120},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":130,"product_name":131,"url":132,"description":133},"prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",[],{"slug":136,"title":137,"body":138,"framework_refs":139,"framework_notes":145},"stealc-takedown-exposes-millions-of-stolen-credentials-from-everyday-users","StealC Takedown Exposes Millions of Stolen Credentials From Everyday Users","The StealC malware operation compromised over 40,000 victims and harvested 6.4 million login credentials before European law enforcement dismantled its infrastructure for the second time in a single year. The repeated need for takedowns highlights how resilient and persistent credential-stealing malware ecosystems are, often rebuilding quickly after disruption. Victims likely fell prey to phishing, malicious downloads, or compromised software, underscoring how poor security hygiene at the user level fuels large-scale credential theft. The stolen credentials can enable account takeovers, fraud, and further intrusions across personal and corporate systems alike. This incident demonstrates that law enforcement action alone is insufficient — individual and organizational defenses must be robust enough to prevent initial infection.",[140,141,142,143,144],"CIS Control 5: Account Management (v8)","CIS Control 14: Security Awareness and Skills Training (v8)","NIST CSF 2.0 PR.AA-01: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(j)","MITRE ATT&CK T1555: Credentials from Password Stores",{"NIS2 Article 21(2)(j)":146,"CIS Control 5: Account Management (v8)":147,"MITRE ATT&CK T1555: Credentials from Password Stores":148,"CIS Control 14: Security Awareness and Skills Training (v8)":149,"NIST CSF 2.0 PR.AA-01: Identity Management, Authentication, and Access Control":150},"NIS2 Article 21(2)(j) requires the use of multi-factor authentication and secured communications, a control that would have neutralized the value of credentials stolen by StealC even after compromise.","CIS Control 5 requires managing and protecting user credentials, including enforcing MFA and monitoring for compromised accounts — directly countering the credential-harvesting impact of StealC.","StealC operates by extracting stored credentials from browsers and applications, which is precisely the technique T1555 describes, making it a direct match for the attack method used against victims.","CIS Control 14 requires organizations to train users to recognize social engineering and malicious downloads, which are the primary delivery vectors for info-stealer malware like StealC.","This category calls for strong authentication controls such as MFA, which would have prevented attackers from using the 6.4 million stolen credentials to access victim accounts."]